CommonMark escapes double-quotes

psalm.xml

@@ -33,6 +33,7 @@
                  <referencedMethod name="Erusev\Parsedown\Configurables\BlockTypes::removing" />
                  <referencedMethod name="Erusev\Parsedown\Configurables\Breaks::enabled" />
                  <referencedMethod name="Erusev\Parsedown\State::mergingWith" />
+                 <referencedMethod name="Erusev\Parsedown\Html\Sanitisation\Escaper::htmlElementValue" />
             </errorLevel>
         </PossiblyUnusedMethod>
     </issueHandlers>

src/Html/Renderables/Text.php

@@ -29,6 +29,6 @@ final class Text implements Renderable
     /** @return string */
     public function getHtml()
     {
-        return Escaper::htmlElementValue($this->text);
+        return Escaper::htmlElementValueEscapingDoubleQuotes($this->text);
     }
 }

src/Html/Sanitisation/Escaper.php

@@ -22,6 +22,15 @@ final class Escaper
         return self::escape($text, true);
     }
 
+    /**
+     * @param string $text
+     * @return string
+     */
+    public static function htmlElementValueEscapingDoubleQuotes($text)
+    {
+        return \htmlspecialchars($text, \ENT_COMPAT, 'UTF-8');
+    }
+
     /**
      * @param string $text
      * @param bool $allowQuotes

tests/ParsedownTest.php

@@ -124,12 +124,12 @@ MARKDOWN_WITH_MARKUP;
 <p>&lt;div&gt;<em>content</em>&lt;/div&gt;</p>
 <p>sparse:</p>
 <p>&lt;div&gt;
-&lt;div class="inner"&gt;
+&lt;div class=&quot;inner&quot;&gt;
 <em>content</em>
 &lt;/div&gt;
 &lt;/div&gt;</p>
 <p>paragraph</p>
-<p>&lt;style type="text/css"&gt;
+<p>&lt;style type=&quot;text/css&quot;&gt;
 p {
 color: red;
 }

tests/data/fenced_code_block.html

@@ -6,9 +6,9 @@ echo $message;</code></pre>
 <pre><code class="language-php">echo 'language identifier';</code></pre>
 <pre><code class="language-c#">echo 'language identifier with non words';</code></pre>
 <pre><code class="language-html+php">&lt;?php
-echo "Hello World";
+echo &quot;Hello World&quot;;
 ?&gt;
-&lt;a href="http://auraphp.com" &gt;Aura Project&lt;/a&gt;</code></pre>
+&lt;a href=&quot;http://auraphp.com&quot; &gt;Aura Project&lt;/a&gt;</code></pre>
 <pre><code>the following isn't quite enough to close
 ```
 still a fenced code block</code></pre>

tests/data/tab-indented_code_block.html

@@ -3,4 +3,4 @@
 $message = 'Hello World!';
 echo $message;
 
-echo "following a blank line";</code></pre>
+echo &quot;following a blank line&quot;;</code></pre>